💬 NLP

Amplifying, Not Learning: Fine-Tuned AI Text Detectors Amplify a Pretrained Direction

This paper argues that AI text detectors primarily amplify a pretrained typicality axis inherent in raw encoders rather than learning a distinct AI-vs-human boundary, a mechanism that explains their failure on non-native writing, their susceptibility to simple interventions, and the fact that minimal probes can match full fine-tuning performance.

Original authors: Alexander Smirnov

Published 2026-05-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Alexander Smirnov

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Amplifying, Not Learning

Imagine you have a giant, pre-built compass inside a computer. This compass was built by reading millions of books and articles before anyone ever tried to teach it to spot AI. It points toward what "typical" or "normal" writing looks like.

The paper argues that AI text detectors don't actually learn a new rule to tell "Human vs. AI." Instead, they just turn up the volume on that pre-existing compass. They amplify the direction the compass was already pointing.

Because of this, the detectors often make a specific mistake: they think very well-written, formal human writing (like a New York Times article) is actually AI, because that writing is so "typical" and "normal" that it sits even further along the "typical" direction than the AI the detector was trained on.

The Core Problem: The "Too Good to Be Human" Trap

The authors found a shocking statistic: 33.5% of formal human articles (like those from the NYT) were flagged as AI with very high confidence. In fact, these human articles were scored as "more likely to be AI" than the average output from seven different major AI models (like GPT-4 or Llama).

The Analogy:
Imagine a metal detector at an airport. It's calibrated to beep for metal.

The AI: Is a small, rusty nail.
The Human: Is a shiny, gold bar.
The Detector's Mistake: Because the gold bar is more metal than the rusty nail, the detector beeps louder for the gold bar. The detector thinks, "This is definitely metal!" and flags the human writer, while the rusty AI nail gets a softer beep.

The paper says the detector isn't broken; it's just following the "typicality" rule too strictly. It confuses "very normal, high-quality writing" with "AI writing."

The Proof: The Compass Was Already There

The researchers proved this by showing that you don't need to train a complex AI to find this pattern.

The Experiment: They took a raw, untrained computer model (a "frozen" brain) and simply drew a straight line between "Average AI" and "Average Human" in its memory.
The Result: Just by looking at that single line, the model could distinguish between AI and Humans almost as well as a fully trained detector.
The "24-Example" Trick: They showed that if you give a frozen model just 24 examples of text to look at, it performs just as well as a model that has been trained on thousands of examples. This proves the "knowledge" was already inside the model; the training just turned up the volume.

The Twist: The "Foreign Language" Test

To prove their theory, they made a prediction that only their "typicality" idea could explain.

The Prediction: If the detector is looking for "typical" writing, it should fail on writing that is atypical or unusual.
The Test: They tested the detector on non-native English speakers (ESL writing). This writing is often grammatically imperfect or "atypical" compared to the standard training data.
The Result: The detector got it backwards! It flagged non-native human writing as "AI" with high confidence, but actually, it was so confused that it sometimes thought the AI was human. This "inversion" happened exactly as the "typicality" theory predicted: the detector hates anything that isn't "standard typical."

The Solution: Turning the Compass, Not Just the Volume

The paper argues that most current methods to fix these detectors (like "debiasing" or changing the training rules) are like trying to fix the metal detector by changing the battery. They don't work because they are just recalibrating the same broken compass.

The Real Fix:
The authors developed a mathematical "knob" (a closed-form predictor) that can physically rotate the compass needle.

Instead of just turning up the volume on the "typical" direction, they can twist the needle slightly to ignore the "typicality" bias.
The Result: By using this twist, they fixed the detector.
- Before: It flagged 33% of human articles as AI.
- After: It flagged almost 0% of human articles as AI, while still catching the AI.
- They tested this on detectors built by other companies (like OpenAI's detector) and it worked there too, without needing to retrain those models.

Summary of Key Findings

Detectors don't learn new boundaries: They just amplify a "typicality" direction that already exists in the model's pre-training.
Formal humans get punished: Because formal human writing is so "typical," detectors think it's AI.
Non-native humans get punished: Because their writing is "atypical," detectors get confused and flip their logic.
Simple is better: You don't need massive training data to find this pattern; a tiny probe (24 examples) finds it instantly.
The Fix: You can't fix this by just retraining. You have to mathematically twist the internal compass of the detector to remove the bias.

What This Means for You

If you are a writer, a student, or a journalist, current AI detectors might flag your work as AI not because you used AI, but because you write too well or too formally. The paper shows that this is a flaw in how the detectors are built, not a flaw in your writing. The authors have provided a mathematical tool to fix this bias, making detectors fairer for everyone.

Technical Summary: Amplifying, Not Learning

Problem Statement
Current AI text detectors, when fine-tuned on standard cross-entropy objectives, exhibit a critical failure mode: they misclassify fluent, formal human writing (e.g., New York Times articles) as AI-generated with high confidence. In canonical settings, 33.5% of such human articles cross the decision threshold ( $P(AI) \ge 0.5$ ), often scoring higher than the median output of seven major Large Language Model (LLM) families. The prevailing assumption is that this is a calibration error or a lack of learned representation. However, the authors argue that this phenomenon is not a bug to be patched but a direct geometric consequence of how fine-tuning interacts with pretrained encoders. Specifically, detectors do not construct a new "AI-vs-human" boundary; they amplify a pre-existing "typicality axis" inherent in the pretrained model's geometry.

Methodology and Core Mechanism
The paper posits that the direction $d_{class} = \text{centroid}(AI) - \text{centroid}(HC3)$ in the pretrained [CLS] space represents a pretrained typicality axis. This axis measures how "typical" a text is relative to the pretraining distribution, rather than its source (AI vs. Human).

Raw Projection: Projecting raw, unfine-tuned [CLS] embeddings onto this axis achieves high discrimination (AUROC 0.806–0.944) between formal human text and the HC3 (Human-ChatGPT Comparison) AI population, reaching 86–106% of the performance ceiling of fully fine-tuned detectors without any task supervision.
Falsifiable Prediction: If the axis measures typicality, non-native ESL writing (which is atypical under pretraining) should project to the opposite side of the boundary compared to AI. The paper confirms this: on non-native ESL data, the AUROC inverts to 0.06–0.20, a result unique to the typicality reading.
Frozen Probes: A logistic regression probe trained on only 24 frozen examples matches the performance of full fine-tuning (0.900 vs. 0.895 AUROC), suggesting the boundary is already encoded in the pretrained geometry.
Closed-Form Predictor: The authors derive a first-order Taylor expansion to predict the logit shift ( $\Delta \logit$ ) resulting from a rank-1 intervention on the representation space: $\Delta \logit_t = -\epsilon \cdot \langle clst, d \rangle \cdot (w_{h,t} \cdot d)$ . This predictor is mathematically exact for linear decoder heads and highly accurate ( $R^2 \ge 0.97$ ) for encoders under small perturbations ( $|\epsilon| \le 0.7$ ).

Key Contributions

Geometric Reinterpretation: The paper establishes that fine-tuned detectors amplify a fixed, pretrained typicality direction rather than learning a new discriminative boundary. Fine-tuning primarily rescales this existing axis (standardized effect amplification $K_{std} \approx 0.86\text{--}1.72$ ) rather than rotating the representation space significantly.
Calibration vs. Representation: Through matched-TPR evaluations, the authors demonstrate that various "fairness-aware" training recipes (CC-loss, dealign-f2c, LoRA, full fine-tuning) are calibration-equivalent. They all operate on the same shared axis; differences in performance are due to threshold choices, not learned representations. Consequently, no thresholding choice on this axis can eliminate the bias against fluent formal humans.
Axis-Manipulating Interventions: The paper introduces a method to close the bias gap by manipulating the axis itself. By ablating the HC3-derived typicality direction using the closed-form predictor (signed- $\epsilon$ $ϵ$ intervention), the authors achieve a strict-Pareto improvement:
- On the canonical ELECTRA detector, this intervention lifts the True Positive Rate (TPR) for HC3-AI from 0.000 to 0.904 at a False Positive Rate (FPR) of 1% for NYT formal humans.
- This intervention transfers to three independently trained third-party RoBERTa detectors without retraining, reducing the OpenAI detector's NYT-FPR by 57%.
Cross-Task Generalization: The same axis-manipulating recipe generalizes to other classifier-fairness tasks, including HANS (lexical overlap), AAVE (dialect bias), Bios (occupational-gender), fake-news, toxicity, and HateCheck, achieving significant bias reduction across binary and multi-class tasks.

Results

Performance: The 24-shot frozen probe matches full fine-tuning. On RoBERTa-base, full fine-tuning actually reduces discrimination compared to raw projection on fluent-formal populations.
Bias Reduction: The signed- $\epsilon$ intervention reduces the NYT-FPR by 25 $\times$ compared to INLP (a standard debiasing method) at matched recall. It outperforms RLACE (which failed to converge in 18/18 cells) and Binoculars by a 6 $\times$ margin on cross-LM held-out evaluations.
Robustness: The intervention preserves cross-LM True Positive Rates (TPR) while drastically reducing false positives on formal human text. The mechanism holds across three architectures (ELECTRA, RoBERTa-base, DeBERTa-v3), though the magnitude of the effect varies (HC3-anchored).
Observer Invariance: Three distinct probes (text-surface caps_rate residualization, representation-space signed- $\epsilon$ ablation, and the closed-form text-pair predictor) converge on the same geometric object, with cosine similarities ranging from 0.74 to 1.00 across architectures.

Significance and Claims
The paper claims that the "AI-vs-human" detection problem is fundamentally a problem of typicality, not source identification. The central claim is that standard fine-tuning recipes merely recalibrate a pre-existing bias where fluent formal human text is "more typical" than the specific AI training distribution (HC3).

Practitioner Implication: "Variant-shopping" across standard training recipes (LoRA, full-FT, CC-loss) will not solve the bias against fluent formal humans because they all amplify the same axis. The only effective solution is an axis-manipulating intervention parameterized by the closed-form predictor.
Theoretical Implication: The paper refutes the idea that detectors learn a new "AI-content" boundary. Instead, they amplify a "typicality" direction where low-perplexity text (whether human or AI) scores as "AI" if it is more typical than the reference AI population.
Limitations: The authors note that while the population-level axis is shared, the per-text mechanisms (e.g., function-word density vs. sentence length) vary by architecture. The magnitude of the effect is anchored to the HC3 distribution and may differ for other AI populations (e.g., RAID). The closed-form predictor is first-order accurate for small $\epsilon$ and direction-asymmetric on certain architectures.

In summary, the paper argues that current detectors are not broken; they are working exactly as the pretrained geometry dictates. Fixing the bias requires not better training, but a geometric intervention that removes the confounding typicality signal.